Attorney Docket No.: 1033-T00534C 

CLAIM AMENDMENTS: 

This listing of claims will replace all prior versions, and listings, of claims in the 
application: 

1 . (Currently amended) A method of detecting intrusion in a host via a monitoring 
daemon operating in conjunction with a configuration file defining data entities to be monitored, 
the method comprising: 

monitoring data entities by comparing a locally stored copy of a digital signature 

associated with each data entity against a corresponding digital signature stored in 
a first remote database; and 

upon identifying a mismatch in compared digital signatures, issuing an instruction to 
record an entry in a log file located in a second remote database, said entry 
identifying a possible intrusion in a host, and issuing a command to an operating 
system of said host to bring said host to a single user state[[;]] a wherein the 
command limits the access to a single user and the access is physical to an 
interface of the host computer . 

2. (Previously presented) The method of claim 1, further comprising issuing a command 
to bring down one or more network interfaces of said host to isolate said host upon identifying 
the mismatch in compared digital signatures. 

3. (Cancelled). 

4. (Previously presented) The method of claim 1, wherein said first remote database and 
said second remote database are located on a single server or a plurality of servers belonging to a 
local area network. 

5. (Currently amended) The method of claim 1, wherein communications between said 
host and said first remote database are encrypted. 
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6. (Currently amended) The method of claim 1, wherein communications between said 
host and said second remote database are encrypted. 

7. (Previously presented) The method of claim 1, wherein said digital signature is an 
MD5 signature and said first remote database is an MD5 database. 

8. (Previously presented) The method of claim 1, wherein said second remote database is 
a SYSLOG database. 

9. (Previously presented) The method of claim 1, wherein said data entities comprise one 
or more of files, configuration files, and directories. 

10. (Currently amended) A system to detect intrusion comprising: 

a host running a monitoring daemon working in conjunction with a configuration file, 

said configuration file identifying files and directories to be monitored in said host 
and said host communicating with external networks via one or more network 
interfaces, said monitoring daemon dynamically monitoring said files and 
directories identified by said configuration file by comparing a locally stored 
digital signature corresponding to each file or directory against a remotely stored 
corresponding digital signature; 

a digital signature database remote from said host storing said digital signatures 

associated with files and directories identified by said configuration file; and 

a log database remote from said host recording entries corresponding to mismatches 
between a digital signature stored in said host and a corresponding digital 
signature in said digital signature database, 

wherein a mismatch identifies a possible intrusion in the host, resulting in a command 

being issued to an operating system of said host to bring said host to a single user 
state[[;]] a wherein the command limits the access to a single user and the access is 
physical to an interface of the host computer . 
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11. (Previously presented) The system of claim 10, wherein said digital signature 
database and said log database are located on a single server or a plurality of servers belonging to 
a local area network. 

12. (Previously presented) The system of claim 10, wherein communications between 
said host and said digital signature database are encrypted. 

13. (Currently amended) The system of claim 10, wherein communications between said 
host and said log database are encrypted. 

14. (Previously presented) The system of claim 10, wherein said digital signature is an 
MD5 signature and said first remote database is an MD5 database. 

15. (Currently amended) An article of manufacture comprising a computer usable storage 
medium having computer readable program code embedded therein to detect intrusion in a host 
via a monitoring daemon operating in conjunction with a configuration file defining data entities 
to be monitored, said medium comprising: 

computer readable program code comprising executable instructions to monitor data 

entities via comparing a locally stored copy of a digital signature associated with 
each data entity against a corresponding digital signature stored in a first remote 
database; 

computer readable program code comprising executable instructions to issue an 

instruction to record an entry in a log file located in a second remote database 
upon identifying a mismatch in compared digital signatures, said entry identifying 
a possible intrusion in a host; and 

computer readable program code comprising executable instructions to issue a command 
to an operating system of said host to bring said host to a single user state upon 
identifying the mismatch in compared digital signatures[[;]] a wherein the 
command limits the access to a single user and the access is physical to an 
interface of the host comput e r . 
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16. (Currently amended) The article of manufacture of [[15]] claim 15, further 
comprising computer readable program code comprising executable instructions to issue a 
command to bring down one or more network interfaces to isolate said host upon identifying the 
mismatch in compared digital signatures. 

17. (Cancelled). 

18. (Currently amended) An intrusion detection and isolation method implemented using 
a monitoring daemon in a host, said host having one or more network interfaces to communicate 
over one or more networks, said method comprising: 

reading a configuration file to identify data entities to be monitored on a host; 

for each data entity to be monitored, extracting a digital signature from said host; 

for each data entity to be monitored, querying a remote digital signature database via said 

one or more network interfaces and requesting a digital signature corresponding 

to said digital signature extracted from said host; 
for each data entity to be monitored, receiving said corresponding digital signature from 

said remote digital signature database; 
matching digital signature received from said remote digital signature database with 

digital signature extracted at said host; 
upon identifying a mismatch, transmitting an instruction to a remote log database via said 

one or more network interfaces, said instruction executed in said remote log 

database to record an entry in a log file indicating a possible intrusion in said host; 

and 

issuing a command to an operating system of said host to bring said host to a single user 
state[[;]] A wherein the command limits the access to a single user and the access is 
physical to an interface of the host computer . 

19. (Currently amended) The intrusion detection and isolation method of claim 18, 
wherein said remote digital signature database and said remote log database are located on a 
single server or a plurality of servers belonging to a local area network. 
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20. (Currently amended) The intrusion detection and isolation method of claim 18, 
wherein communications between said host and said remote digital signature database are 
encrypted. 

21. (Currently amended) The intrusion detection and isolation method of claim 18, 
wherein communications between said host and said remote log database are encrypted. 

22. (Currently amended) The intrusion detection and isolation method of claim 18, 
wherein said remote digital signature database is an MD5 database. 

23. (Currently amended) The intrusion detection and isolation method of claim 18, 
wherein said remote log database is a SYSLOG database. 

24. (Previously presented) The intrusion detection and isolation method of claim 18, 
wherein said data entities are any of the following: system files, configuration files, or 
directories. 

25. (Previously presented) The intrusion detection and isolation method of claim 18, 
further comprising issuing a command to bring down said one or more network interfaces to 
isolate said host. 
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